76a4ee2aef00fad00996f56761910c93f0a4ab03c72d4033a9f5985c7f0f05cd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b41b96184d12487f6187eab0796edcf5_JaffaCakes118
Size

70KB
Sample

240821-tgq16axgmc
MD5

b41b96184d12487f6187eab0796edcf5
SHA1

baf6a15ea9dab2a2bc608e05abbd6446162e3efc
SHA256

76a4ee2aef00fad00996f56761910c93f0a4ab03c72d4033a9f5985c7f0f05cd
SHA512

22c952259676d561aa7b9e6edff7627e863b21e0f8b44dbe8619653d3fb7557f635f930b29ceb6acd8a001af9712f2aa1a7a7b94a85a24644d9a49c40d4dabe2
SSDEEP

1536:JB1ivX58lb8Quc7YufcxlaXYBfJpzTYu3+iA8k:bUvEYQucUScqCJpQiV

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  b41b96184d12487f6187eab0796edcf5_JaffaCakes118
- Size
  
  70KB
- MD5
  
  b41b96184d12487f6187eab0796edcf5
- SHA1
  
  baf6a15ea9dab2a2bc608e05abbd6446162e3efc
- SHA256
  
  76a4ee2aef00fad00996f56761910c93f0a4ab03c72d4033a9f5985c7f0f05cd
- SHA512
  
  22c952259676d561aa7b9e6edff7627e863b21e0f8b44dbe8619653d3fb7557f635f930b29ceb6acd8a001af9712f2aa1a7a7b94a85a24644d9a49c40d4dabe2
- SSDEEP
  
  1536:JB1ivX58lb8Quc7YufcxlaXYBfJpzTYu3+iA8k:bUvEYQucUScqCJpQiV
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence